It's all an incentive for "don't just churn software, plan well ahead".

This also seems to be broadly incompatible with fixing certain security vulnerabilities - would everybody have to maintain TLS 1.1 or plaintext api endpoints for old clients?

Or they would forced to produce an update that doesn't do anything other than e.g. upgrade the TLS version --- and has absolutely nothing else.